On March 16, 2022, the Consumer Financial Protection Bureau (“CFPB”) announced that it would combat perceived discrimination in the consumer financial marketplace by expanding its authority to target unfair, deceptive or abusive acts or practices (“UDAAPs”). Specifically, the CFPB directed examiners to scrutinize whether potentially discriminatory conduct may be unfair. The CFPB simultaneously published an updated exam manual for UDAAPs that provides guidance on determining if an entity has “unfairly discriminated” against consumers.[1]
The new expansion of the CFPB’s authority will allow the Bureau to examine for discrimination across all consumer financial products and consumer finance markets, and not just extensions of credit. The Equal Credit Opportunity Act (“ECOA”) prohibits discriminatory lending practices and may be enforced by the CFPB and private plaintiffs. The CFPB, under both Acting Director David Uejio and Director Rohit Chopra, previously announced its intention to scrutinize practices for discriminatory bias outside of lending. This announcement outlines the mechanism by which the CFPB plans to do so, with the Bureau noting that it will closely examine financial institutions’ decision-making in advertising, pricing and other areas, as well as institutions’ use of algorithms and artificial intelligence (“AI”) models, for any discriminatory practices that could form the basis of potential UDAAP violations.
In this client update, we provide detail on the expansion in the CFPB’s authority and outline the updates to the CFPB exam manual. We also discuss the key takeaways for financial institutions.
Discrimination as a Form of Unfairness
Statutory Background
ECOA, implemented through Regulation B, makes it unlawful for any creditor to discriminate against any applicant on the basis of race, color, religion, national origin, sex or marital status, or age, or because the applicant derives income from a public assistance program or has exercised their right under the Consumer Credit Protection Act. [2] Since the passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank Act”), the CFPB has had the authority to enforce compliance with ECOA against creditors.[3]
In addition to granting authority to supervise and enforce compliance with ECOA, the Consumer Financial Protection Act (the “CFPA”) authorizes the CFPB to enforce the CFPA’s prohibition against UDAAP violations committed by any covered person or service provider in connection with the provision or offer of a consumer financial product or service. The CFPB also is authorized under the CFPA to supervise certain covered persons for purposes of, among other things, assessing their compliance with federal consumer financial laws, including UDAAP, and for detecting and assessing risks to consumers and markets.
In its press release,[4] the CFPB announced its plans to combat discrimination that may meet the criteria for “unfairness” under this UDAAP authority. Under the CFPA, an act or practice is unfair if (1) it causes or is likely to cause substantial injury to consumers that is not reasonably avoidable, and (2) such substantial injury is not outweighed by countervailing benefits to consumers or competition. The CFPB’s updates to its exam manual state that discriminatory conduct causes substantial injury that cannot be avoided by the consumer and, as such, is unfair.
This change markedly expands the CFPB’s authority to police myriad consumer financial markets for discriminatory practices. ECOA has traditionally been interpreted to be limited to discrimination in lending or advertising specifically to applicants for extensions of credit, and not to apply more broadly to other financial products, services or advertising activities.[5] However, the CFPB’s UDAAP authority applies to any consumer financial product or service, as that term is defined under the CFPA. While in recent years, the CFPB has taken a more aggressive stance regarding the breadth of discriminatory activities that can be covered by ECOA; for example, through stating that radio advertising to prospective credit applicants can be scrutinized as a discriminatory practice, this position is being litigated.[6] As such, classifying discriminatory conduct as potentially unfair under UDAAP permits the CFPB to supervise for discrimination in a much broader array of consumer financial products and markets, such as by reviewing advertising practices that are unrelated to lending.
CFPB Director Rohit Chopra previously indicated his view that discrimination could come under the purview of “unfairness” when he was Commissioner of the Federal Trade Commission. In 2020, Chopra stated that the FHA and ECOA do not cover many areas of the economy and that the Federal Trade Commission Act (“FTC Act”) can serve as “an important gap-filler” to combat discrimination as “many discriminatory practices are also unfair under the FTC Act, which covers almost the entire economy.”[7] The definition of unfairness under the CFPB’s UDAAP authority is the same as the definition under the FTC Act, and has been construed similarly by federal courts around the country.
Expanded Authority
The CFPB noted in its press release and accompanying blog post[8] the extent to which the use of its UDAAP authority under the CFPA will expand the Bureau’s ability to combat discriminatory practices across the consumer financial markets. The Bureau noted that, going forward, it will examine for discrimination in credit, servicing, collections, consumer reporting, payments, remittances and deposits. The CFPB cited a practice of not allowing people of color to open deposit accounts as an example of a discriminatory practice that falls outside of the fair lending laws but that can be policed through the CFPB’s unfairness authority.
In particular, the Bureau highlighted its intention to examine financial institutions’ decision-making in advertising, marketing and pricing, and noted especially its focus on the use of machine learning and automated decision-making models in these areas. The CFPB asserted that algorithms and AI can perpetuate biased outcomes and strengthen structural inequities and stated that it intends to closely examine whether companies’ reliance on such models results in any potential discriminatory outcomes.
As we have recently discussed in blog posts[9] and webcasts focused on the intersection of AI and consumer finance,[10] the CFPB has previously highlighted its concern about financial institutions’ use of AI in targeted advertising, making underwriting decisions, and generally across business lines. Last year, the FTC released a blog post on truth, fairness and equity in AI, which stated that the FTC can challenge AI models as unfair under the FTC Act.[11] During his tenure as FTC Commissioner, Chopra expressed his view that unfairness is an appropriate standard for assessing automated decision-making given that black-box algorithms, machine learning and AI can reinforce implicit biases.
In this regard, the CFPB further emphasized its expectation that companies appropriately test for and monitor their decision-making processes. The press release noted that the CFPB will require supervised companies to show their processes for assessing risks and discriminatory outcomes, including their documentation of customer demographics and assessment of the impact of products and fees on different demographic groups. The CFPB also expressly added for the first time to the UDAAP exam manual that they plan to request documentation regarding the use of models, algorithms and decision-making processes.
As we have previously observed, as companies invest millions of dollars in AI, it is important to carefully consider the potential for increased scrutiny of their AI practices to avoid the potential need to decommission valuable models that regulators, including the CPFB, may view as non-compliant with ECOA, UDAAP, or other laws and regulations.[12] Companies should therefore consider implementing policies, procedures and governance processes to ensure appropriate risk management and mitigation around their AI models, including with respect to potential discrimination concerns.
Updates to the CFPB Exam Manual for Evaluating UDAAPs
Consistent with Director Chopra’s announcement, the CFPB updated its examination manual on UDAAP with specific guidance for examiners regarding discriminatory acts or practices.
These updates are as follows:
- Examination objectives. The manual directs examiners to identify acts or practices that materially increase the risk of consumers being treated in an unfair, deceptive or abusive manner. This objective was updated to explicitly include “discriminatory acts or practices” among the acts and practices examiners must identify.
- Documents for review. Examiners are directed to obtain and review copies of documents to identify potential areas of UDAAP concerns. The manual was updated to include the following additional documents:
- Documentation regarding the use of models, algorithms and decision-making processes used in connection with consumer financial products and services.
- Information collected, retained or used regarding customer demographics, including the demographics of customers using various products or services, and the breakdown of consumer demographics for various product uses, fees, revenue sources and costs, or the impacts of various products and services on specific demographics.
- Any demographic research or analysis relating to marketing or advertising of consumer financial products or services.
- Determinations based on review of documents. Examiners are directed to review all relevant written policies and procedures, customer complaints received by the entity or by the CFPB, internal and external audit reports, statistical and management reports and examination reports and to make determinations regarding potential UDAAP concerns. Additional determinations that examiners are now directed to make based on their review of these materials are whether:
- The entity has a process to prevent discrimination in relation to all aspects of consumer financial products or services the entity offers or provides, which includes the evaluation of all policies, procedures and processes for discrimination prior to implementation or making changes, and continued monitoring for discrimination after implementation.
- The entity’s compliance program includes an established process for periodic analysis and monitoring of all decision-making processes used in connection with consumer financial products or services, and a process to take corrective action to address any potential UDAAP concerns related to their use, including discrimination.
- The entity has established policies and procedures to review, test and monitor any decision-making processes it uses for potential UDAAP concerns, including discrimination.
- Determinations regarding internal controls. Examiners are directed to assess whether the entity’s internal controls are adequate to prevent UDAAPs. The following additional considerations with respect to these internal controls include:
- Whether the entity has established policies and procedures to mitigate potential UDAAP concerns arising from the use of its decision-making processes, including discrimination.
- Whether the entity’s policies, procedures and practices do not target or exclude consumers from products and services, or offer different terms and conditions, in a discriminatory manner.
- Whether the entity has appropriate training for customer service personnel to prevent discrimination.
- Evaluation of areas for transaction testing. Examiners are directed to identify areas for potential transaction testing based on a high-level assessment of the entity’s products, services and customer base and to make various determinations. These determinations were expanded to include whether:
- The entity improperly gives inferior terms to one customer demographic as compared to other customer demographics.
- The entity improperly offers or provides more products or services to one customer demographic as compared to other customer demographics.
- Customer service representatives improperly treat customers of certain demographics worse or provide extra assistance or exceptions to customers of certain demographics.
- The entity engages in targeted advertising or marketing in a discriminatory way.
- The entity uses decision-making processes in its eligibility determinations, underwriting, pricing, servicing or collections that result in discrimination.
- The entity fails to evaluate and make necessary adjustments and corrections to prevent discrimination.
- Transaction testing procedures. If examiners determine that transaction testing is required then the examination manual outlines procedures for doing so. The following additions were made to the guidelines for such transaction testing:
- Marketing materials. Examiners are required to make determinations based on a review of marketing materials, customer agreements and other disclosures. The manual was updated with an additional determination of whether marketing or advertising, including digital advertising, improperly target or exclude consumers on a discriminatory basis.
- Terms or Services as Advertised. Examiners are required to evaluate whether products and services are consistent with disclosures and policies. In doing so examiners are required to review a sample of each product or service that customers receive. The manual was updated to ensure that the sample selected identifies the decision-making processes used to determine approval or denial for a product and the terms of the offer, as well as the corresponding inputs used in the decision-making processes for each account in the sample. Examiners then must make determinations based on their evaluation, which now includes whether the entity offers products and services to consumers in a manner that prevents discrimination.
- Employees and third parties. Entities are evaluated to ensure that they monitor the activities of employees and third-party contractors, marketing sales personnel, vendors and service providers to ensure they do not engage in UDAAPs. The manual was updated to include a direction to examiners to ensure that the entity has a process to take prompt corrective action if the decision-making processes it uses produce deficiencies or discriminatory results.
- Servicing and collections. Examiners are directed to evaluate whether servicing and collections practices raise potential UDAAP concerns. In doing so the factors examiners must consider now include whether the entity ensures that employees and third-party contractors refrain from engaging in servicing or collection practices that lead to differential treatment or disproportionately adverse impacts on a discriminatory basis.
Key Takeaways
The CFPB’s changes to its UDAAP examination manual mark a substantial expansion of its authority to target discriminatory practices. Companies subject to the CFPB’s jurisdiction should carefully review the revised exam manual and consider appropriate steps to address the changes within their business. In particular, supervised entities should evaluate the extent to which their current practices, including policies and procedures are positioning them for success in mitigating the risk of discrimination, including through trainings, transaction testing, testing and validation of AI models in underwriting and other key business lines, and appropriate board oversight of fair lending and AI.
It is notable that the Bureau executed this change by announcing updates to its manual rather than engaging in a rulemaking with the required public notice and comment period, though it is not yet clear the extent to which these updates to the CFPB’s supervision policy will lead to the Bureau bringing enforcement actions using its UDAAP authority against entities engaged in discriminatory conduct. In such an enforcement action, the CFPB could face legal challenges regarding its classification of discrimination as an unfair practice.
* * *
Please do not hesitate to contact us with any questions.
[1] See CFPB Consumer Laws and Regulations, Unfair, Deceptive, or Abusive Acts or Practices, (Mar. 2022), available here.
[2] 15 U.S.C. . § 1691(a)(1).
[3] 15 U.S.C. § 1691(a); 12 C.F.R. § 1002.1(a) (providing that Regulation B extends to all creditors with certain exceptions). The Bureau’s authority to supervise for compliance with ECOA extends to mortgage lenders and servicers, payday lenders, student loan servicers, larger participants in consumer financial markets, and banks, credit unions, and thrifts with more than $10 billion, as well as their affiliates. See 12 U.S.C. §§ 5514; 5515.
[4] CFPB, CFPB Targets Unfair Discrimination in Consumer Finance (Mar. 16, 2022), available here,
[5] This is in contrast to the Fair Housing Act (which the Departments of Justice and Housing and Urban Development enforce), which prohibits discrimination in a broader array of contexts related to housing transactions, such as explicitly prohibiting discrimination in housing advertising. See 42 U.S.C. § 3604(c) makes it unlawful to “make, print, publish, or cause to be made, printed or published any notice, statement, or advertisement, with respect to the sale or rental of a dwelling that indicates any preference, limitation, or discrimination based on race, color, religion, sex, handicap, familial status, or national origin, or an intention to make any such preference, limitation, or discrimination.”
[6] See CFPB, Consumer Financial Protection Bureau Files Suit Against Mortgage Creditor for Discriminatory Mortgage-Lending Practices (Jul. 15, 2020), available here.
[7] Introductory Remarks of Commissioner Rohit Chopra: National Fair Housing Alliance 2020 National Conference (Oct. 6, 2020), available here.
[8] Eric Halperin and Lorelei Salas, Cracking down on discrimination in the financial sector (Mar. 16, 2022), available here.
[9] See our previous Debevoise In Depth, Increased Focus by Federal Regulators on AI and Consumer Protection in the Financial Sector (Nov. 10, 2021), available here.
[10] See Debevoise Data Security Weekly Webcast, Episode 16: Artificial Intelligence – Vendor Contracting and Diligence (Mar. 22, 2022), available here and Episode 12: Artificial Intelligence and Consumer Data – A Discussion with Kaitlin Asrow, Fintech Policy Advisor for Federal Reserve Bank of San Francisco (Mar. 3, 2021), available here.
[11] See our previous Debevoise Update: The Future of AI Regulation (Part 3): The FTC’s New Guidance on Using AI Truthfully, Fairly, and Equitably (May 3, 2021). available here.
[12] See our previous Debevoise In Depth, Model Destruction – The FTC’s Powerful New AI and Privacy Enforcement Tool, available here.
